Posted by Basketts on 3/18/2021 9:43:00 PM (view original):
Oh, you don't have to worry about that for default behavior. Our company is just strict and has shut off access to http (without special approval). Just an annoyance more than anything.
I don't have any issue at home aside from the standard not secure notice chrome pushed in version 68.
got it, that makes sense. i was thinking it was probably your IT folks except for the bit about you being able to change them!
anyway, i am not anti-encryption. i am only anti-encryption as a (perhaps required) default for the security insensitive web - which includes many sites like mine which exchange 0 personal or sensitive information (the prime rationale for SSL other places - which i 100% support!). i thought about putting https on but i sort of was taking a moral stand - i mean, didn't plan on anyone bringing it up - it was supposed to be a private moral stand. but i like the idea of small websites using forced HTTP traffic to help stave off google requiring https for all chrome, or at least sans some ugly click-through that is barely click-through-able, in standard chrome fashion. obviously that's a pipe dream, but it made me feel a little better anyway?
anyway my real concern comes from this - i don't know if you have worked with IT folks and SSL certificates to have a sense of the ridiculous confusion that ensues. its really counter intuitive, but for a lot of folks who don't really know what they are doing, and for far too many who supposedly do, anything with SSL certs proceeds extremely dubiously (the second there is a problem, at least). plus they expire and have to be rotated frequently (every year now, as of several months ago). i know letsencrypt is supposed to be a lot easier, i've heard that from pretty confused folks, so it must be true. which is great! but for me, i've done a ton of stuff with SSL certs in infinitely more complex configurations, so it was never really about my 10 minutes (per year - and probably soon it will be months because why not?? its already dropped 3 years to 2 recently, and again 2->1 just end of 2020). anyway, its the old web that i worry about... a lot of it built and maintained by barely-technical folks. i can't get a 6 figure developer to look at an SSL error without wanting to stab them in the throat. its not just one either. its like... endemic to the industry. even the state of SSL implementation in programming languages and major tools is a mess - much better than 5 year ago - but its still a disaster, with probably a minority of those languages and tools even to this day having a complete and completely functional SSL implementation.
3/19/2021 11:58 AM (edited)